We have an interesting discussion here about file deletion on iOS devices. The question was: if I delete a file using NSFileManager, what's happening under the hood?
My understanding is that deletion is performed by removing the corresponding file entry from the file system table.
The counter argument is that a file handle remains in some way and only a flag gets set which marks the file as deleted. If the user had root access to the iOS device, he could potentially reset that flag and recover the file content.
In both cases we agree that the actual file content will not be overwritten and the plain bytes still exist on the flash memory/disk until the block is occupied by another file.
The idea is now: if the second version is true, we could overwrite the file with a one byte content prior to deletion (even if that byte gets written to a new location on the flash drive without actually overwriting the old content). If then the file is recovered, only the overwritten one byte content is available.
Note that we're not talking about forensic analysis of the flash drive which could maybe recover the original file content.
So to recap:
- How does deletion of a file on iOS work internally?
- Does the overwrite approach prevent undeletion?